Increase policy version to 26.

Increase the SELinux policy version to 26.  This is needed
for name-based transitions used by the manta sepolicy.
Requires kernel 3.0 or higher.

Change-Id: I046fa9f7122f77506c70b2c735345bc0194935df
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
am e543a8bc: Increase policy version to 26.

* commit 'e543a8bc2a2d08ff381e5ae9e34cc2a094acf895':
  Increase policy version to 26.
Remove unneeded device type.

timerirq_device has been removed in favor
of using the existing sensors_device domain.

Change-Id: I503e4a511c2901890356559c0afb971392b4ec6f
Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
am 84c46de5: Remove unneeded device type.

* commit '84c46de5251bbf567740d065c833cd3a3662e4f5':
  Remove unneeded device type.
Allow ueventd to relabel sysfs nodes.

Required for If8b8d66120453123c1371ce063b6f20e8b96b6ef .

Change-Id: I98871b957db8b291cbbb827b5eb39b4279ce4194
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
am 2c831009: Fix various SELinux denials.

* commit '2c831009a59f122fc870bedb6ed084eb5aeea0b0':
  Fix various SELinux denials.
am 404fc4fa: Merge "Add the sys_resource capability to sdcardd." into jb-mr2-dev

* commit '404fc4fa696d1d74866113d949d90a71de3905f9':
  Add the sys_resource capability to sdcardd.
am cebe6a65: Allow ueventd to relabel sysfs nodes.

* commit 'cebe6a653b96b4726d9cf68995651a56a4cf9be1':
  Allow ueventd to relabel sysfs nodes.
Drop SELinux management rules from AOSP.

As AOSP does not support the device admin API or the older
SEManager system app, just drop the allow rules associated with
permitting SELinux management via device admin or a system app.

Change-Id: Icdf40c9e6d343b19c156e4c7aea4cfb8c5f234ad
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Allow all domains to read the log devices.

Read access to /dev/log/* is no longer restricted.
Filtering on reads is performed per-uid by the kernel logger driver.

Change-Id: Ia986cbe66b84f3898e858c60f12c7f3d63ac47cf
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Strip unnecessary trailing semicolon on macro calls.

Change-Id: I013e08bcd82a9e2311a958e1c98931f53f6720c9
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Coalesce rules for allowing execution of shared objects by app domains.

Change-Id: I809738e7de038ad69905a77ea71fda4f25035d09
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Allow fstat of platform app /data/data files.

Change-Id: I8d46a809c08cd21b0d6c3173998035ab3cc79ada
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Allow apps to execute the shell or system commands unconditionally.

Change-Id: I54af993bd478d6b8d0462d43950bb1a991131c82
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Remove unnecessary rules.

Redundant with other rules or not required for untrusted app.

Change-Id: Idb5d50326cc14696423cf133508c0d013c5928a6
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Allow all domains to read /dev symlinks.

Change-Id: I448a5553937a98775178b94f289ccb45ae862876
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Do not allow reading all directories for the CTS.

The test gracefully handles unreadable directories, so
we do not need to allow this for all file types.

Change-Id: Ib5f5be7cacc3f0270b72c046200cc3d21f3fc374
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Document the relevant tests associated with specific rules.

Change-Id: I09b4e33b1c9ea201a96d2f07cb74bdb804b5aad2
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Merge "Drop SELinux management rules from AOSP."
Add new domains for private apps.

/data/app-private is used when making an
app purchase or forward locking. Provide a
new label for the directory as well as the
tmp files that appear under it.

Change-Id: I910cd1aa63538253e10a8d80268212ad9fc9fca5
Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>